Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20250619-en - resource tags
- submitted
11/05/2026, 13:45
General
- Target 2026-05-11_cfb99cd7e0a2add65544f851fcf56722_elex_wannacry.exe
- Size 372KB
- Sample260511-q2ebbabv3t
- SHA256 2c72cd5ec207926d955435e00d94c0192957c212117a63a727253ab7062465a2
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_cfb99cd7e0a2add65544f851fcf56722_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_cfb99cd7e0a2add65544f851fcf56722_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CEDAE551-1361-499c-919C-3D250F2EF0D7}.exeC:\Windows\{CEDAE551-1361-499c-919C-3D250F2EF0D7}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4285C315-505A-4a29-873D-85BBFE7168B5}.exeC:\Windows\{4285C315-505A-4a29-873D-85BBFE7168B5}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6DCB1410-EAC1-4e10-BCEF-91AC33EBDB5E}.exeC:\Windows\{6DCB1410-EAC1-4e10-BCEF-91AC33EBDB5E}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{326CA7A6-57B8-4b27-AAEA-835FF47C7B3A}.exeC:\Windows\{326CA7A6-57B8-4b27-AAEA-835FF47C7B3A}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E06A1B12-F6F5-44e8-92CD-E7B6D8B84976}.exeC:\Windows\{E06A1B12-F6F5-44e8-92CD-E7B6D8B84976}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{261B8040-FE02-498e-BEBB-2FF48315361E}.exeC:\Windows\{261B8040-FE02-498e-BEBB-2FF48315361E}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{34CCC685-031B-4b2a-BC5B-47EF91F48BE8}.exeC:\Windows\{34CCC685-031B-4b2a-BC5B-47EF91F48BE8}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{963EC87E-C939-407a-BB33-133068821974}.exeC:\Windows\{963EC87E-C939-407a-BB33-133068821974}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E4C1C68C-4C16-46b9-A825-D0151DACD4DA}.exeC:\Windows\{E4C1C68C-4C16-46b9-A825-D0151DACD4DA}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{88CA87E6-7800-4522-8176-A3BB6AD9BF32}.exeC:\Windows\{88CA87E6-7800-4522-8176-A3BB6AD9BF32}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D404D6AE-08A3-44f2-A91A-7E41B41A3D6A}.exeC:\Windows\{D404D6AE-08A3-44f2-A91A-7E41B41A3D6A}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{88CA8~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E4C1C~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{963EC~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{34CCC~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{261B8~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E06A1~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{326CA~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6DCB1~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4285C~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CEDAE~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{261B8040-FE02-498e-BEBB-2FF48315361E}.exe
{326CA7A6-57B8-4b27-AAEA-835FF47C7B3A}.exe
{34CCC685-031B-4b2a-BC5B-47EF91F48BE8}.exe
{4285C315-505A-4a29-873D-85BBFE7168B5}.exe
{6DCB1410-EAC1-4e10-BCEF-91AC33EBDB5E}.exe
{88CA87E6-7800-4522-8176-A3BB6AD9BF32}.exe
{963EC87E-C939-407a-BB33-133068821974}.exe
{CEDAE551-1361-499c-919C-3D250F2EF0D7}.exe
{D404D6AE-08A3-44f2-A91A-7E41B41A3D6A}.exe
{E06A1B12-F6F5-44e8-92CD-E7B6D8B84976}.exe
{E4C1C68C-4C16-46b9-A825-D0151DACD4DA}.exe
memory/2132-40-0x0000000000590000-0x000000000066C000-memory.dmp
memory/2132-36-0x0000000000590000-0x000000000066C000-memory.dmp
memory/2376-11-0x00000000008D0000-0x00000000009AC000-memory.dmp
memory/2376-6-0x00000000008D0000-0x00000000009AC000-memory.dmp
memory/2560-16-0x0000000000800000-0x00000000008DC000-memory.dmp
memory/2560-12-0x0000000000800000-0x00000000008DC000-memory.dmp
memory/2788-48-0x0000000000930000-0x0000000000A0C000-memory.dmp
memory/2788-52-0x0000000000930000-0x0000000000A0C000-memory.dmp
memory/4284-34-0x0000000000830000-0x000000000090C000-memory.dmp
memory/4284-30-0x0000000000830000-0x000000000090C000-memory.dmp
memory/4696-22-0x0000000000670000-0x000000000074C000-memory.dmp
memory/4696-18-0x0000000000670000-0x000000000074C000-memory.dmp
memory/4928-24-0x00000000007A0000-0x000000000087C000-memory.dmp
memory/4928-28-0x00000000007A0000-0x000000000087C000-memory.dmp
memory/5148-60-0x00000000008D0000-0x00000000009AC000-memory.dmp
memory/5148-64-0x00000000008D0000-0x00000000009AC000-memory.dmp
memory/5192-46-0x0000000000980000-0x0000000000A5C000-memory.dmp
memory/5192-42-0x0000000000980000-0x0000000000A5C000-memory.dmp
memory/5204-54-0x00000000008F0000-0x00000000009CC000-memory.dmp
memory/5204-58-0x00000000008F0000-0x00000000009CC000-memory.dmp
memory/5360-0-0x0000000000AA0000-0x0000000000B7C000-memory.dmp
memory/5360-4-0x0000000000AA0000-0x0000000000B7C000-memory.dmp